fix: 将 kubectl secret 创建也纳入重试循环，修复重试未生效的问题

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -130,6 +130,10 @@ jobs:
           sed -i "s|redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0|${{ env.REDIS_URL }}|g" k8s/backend-deployment.yaml
           sed -i "s|redis://zyc:Zyc188208@redis-shzlsczo52dft8mia.redis.ivolces.com:6379/0|${{ env.REDIS_URL }}|g" k8s/celery-deployment.yaml
 
+          # All kubectl operations with retry (K3s 内网连接可能抖动)
+          for attempt in 1 2 3; do
+            echo "Deploy attempt $attempt/3..."
+            {
               # Create/update image pull secret for CR
               kubectl create secret docker-registry cr-pull-secret \
                 --docker-server="${{ env.CR_SERVER_ACTIVE }}" \
@@ -147,11 +151,7 @@ jobs:
                 --from-literal=ALIYUN_SMS_ACCESS_SECRET='${{ secrets.ALIYUN_SMS_ACCESS_SECRET }}' \
                 --dry-run=client -o yaml | kubectl apply -f -
 
-          # Apply manifests (with retry for transient network issues)
-          set -o pipefail
-          for attempt in 1 2 3; do
-            echo "Deploy attempt $attempt/3..."
-            {
+              # Apply manifests
               kubectl apply -f k8s/backend-deployment.yaml
               kubectl apply -f k8s/celery-deployment.yaml
               kubectl apply -f k8s/web-deployment.yaml